FameUp Privacy Policy

EFFECTIVE DATE: August 25, 2025

FameUp, Inc. (“FameUp,” “Company,” “we” or “us”) provides a platform that facilitates collaboration between individuals and businesses (each a “Brand”) and content creators that create, distribute and promote content on behalf of Brands (each an “Influencer”).  In this Privacy Policy (“Policy”), we describe how Company collects, uses, and discloses information related to users of our website www.fameup.com (the “Site”), the FameUp mobile application (the “App”) and the services available through the Site and App (collectively, the “Services”).  This includes personal information we collect related to Influencers and Advertisers and campaigns and collaborations within the Services (“Campaigns”). 

Your access to or use of the Services, and any dispute over privacy, is subject to this Policy, as well as the terms of use and any other agreement between you and Company (the “Terms”).  By accessing or using any of our Services, you understand and agree that we may collect, use, and disclose your personal information in accordance with this Policy and the Terms.  

Two Types of Campaigns. FameUp facilitates two distinct types of Campaigns: (i) Cash Campaigns, in which the Influencer receives monetary compensation processed through the App; and (ii) Barter Campaigns, in which the Brand provides goods, products, services, or experiences (“Barter Compensation”) directly to the Influencer in exchange for content creation services. The personal information processed for each Campaign type may differ, as described in this Policy. For tax purposes (IRS), FameUp acts solely as a technical intermediary in Barter Campaigns and is NOT the source of income or payer of record.  

I. INFORMATION WE COLLECT

We collect information directly from users, from third parties, and automatically through your use of the Services.

Information We Collect Directly from You.

You may access our Site without registering, but to use our App and collaborate through our Services you must have an (Influencer or Brand) account with us. We collect profile and account-related information from Influencers and Brands, and we also collect information from other users of our Site and Services. The information we collect from you depends on how you use our Services, but generally includes:

• Account information. We collect name, email address and other contact information, as well as information about any collaborations, campaigns, offers and deals you submit through the Services, and other transactional and activity information related to your use of the App and Services. We may also collect your account handles and usernames for third party platforms and channels, as well as other demographic and profile information you share through the Services. Also, if you use the Services as a representative of a company we also collect the name of the company, and information about your title and role with that company. We also collect information from and about the parents and legal guardians of Influencers under the age of 18.
• Payment information. We (or our payment processors) collect and store billing and payment information in order to process payments from Brands and to Influencers.
• We collect and maintain copies of and records related to any content or information that is created, submitted, shared, published, or promoted related to Campaigns, including videos, images, files, messages, comments, ratings, reviews, briefs, offers, deals, survey responses, performance metrics, and metadata.
• Communications and requests. If you contact us through the Site or App, or by email, mail, phone, or otherwise regarding the Services, we collect and maintain a record of your contact details, communications, and our responses.

 

Additional Information We Collect from Influencers.

For Influencer Account creation and Campaign participation, we collect:

• Identification data: full name, date of birth, gender;
• Contact data: email address, phone number, country, state, postal address, postal code;
• Banking and tax data: bank name, IBAN/account number (for Cash Campaigns), tax forms (W-9 for U.S. tax residents; W-8BEN or W-8BEN-E for non-U.S. tax residents) — all collected and stored by our Payment Processor (e.g., Stripe), not directly by FameUp;
• Social media data: account handles for Instagram and/or TikTok, follower count, engagement rate, public profile visibility, prior public posts;
• Demographic and profile data: age range, gender, interests (as communicated through social media accounts);
• Tax residency status data: derived from the documentation provided through the Payment Processor’s verification process;
• In-app activity data: Campaign applications, QR scan timestamps, Content delivery records, posting links.

 

Additional Information We Collect from Brands.

For Business Account creation and Campaign initiation, we collect:

• Company identification: name, U.S. taxpayer identification number (EIN, if applicable), state of incorporation, headquarters address;
• Representative data: name, business email, phone, role/title;
• Subscription data: chosen plan, billing frequency, payment method (processed by Stripe);
• Campaign data: product/service description, Barter Compensation Value (BCV), delivery location, brief content, communications with Influencers, monthly performance reports.

 

Information Processed Specifically in Barter Campaigns.

For Barter Campaign execution, we process additional data specific to the in-kind exchange:

• Barter Compensation Value (BCV) declared by Brand;
• Description of the Barter Compensation (product or service);
• Pickup/delivery location and time window;
• Influencer application timestamp and Brand acceptance timestamp;
• QR code scan timestamp (confirmation of receipt of Barter Compensation);
• Content delivery records: post type, publication date, post URL, views, likes;
• In-app communications between Influencer and Brand (briefing, questions, confirmations);
• Sanctions records (warnings, suspensions, account terminations).

 

Information We Collect Automatically.

In addition, we may automatically collect information about your use of our Services (including through cookies and similar technologies), such as IP address, advertising ID, device ID, and online identifiers, location information, browser and device type, operating system, hardware and software versions, language, device name and other device information; the website that led you to our Services, the website to which you go after leaving our Services, the dates and times you access our Services, and your other activities within the Services; and other network and connection information such as the name of your mobile operator or ISP, language, time zone, or other similar information.

We may also use pixels in HTML emails to understand if individuals read the emails we send to them. We may combine this information with other information that we have collected about you, including, where applicable, your name and other personal information.

Information We Collect from Third Parties.

We may also collect and receive personal information about users from third party sources, including:

• Social Network Profiles and Accounts: name, username or handle, contact information and other public profile information from third-party platforms (TikTok, Instagram) that integrate with or share Content through the Services.
• Metrics and Reports: information from third party social networks and platforms related to the performance of your Content and Campaigns.
• Leads: contact lists for individuals and clients who may be interested in our Services.

We store the information that we receive from third parties with other information that we collect. For information about how third parties may use and disclose your information, please consult their respective privacy policies. We have no control over how any third party uses or discloses the information they collect about you. We do not sell your personal information. Third-party providers may only process data on our behalf under written agreements that require appropriate safeguards.

II. OUR PURPOSES FOR USING PERSONAL INFORMATION

In general, we use the personal information we collect for the following purposes:

• Operating the Services, Site, and App and providing related support.
• Responding to inquiries and fulfilling requests.
• Analyzing and improving the Services, Site, App, and our business.
• Personalizing experiences.
• Marketing communications.
• Market research and customer satisfaction.
• Security of the Services.
• Protecting our legal rights and preventing misuse.
• Complying with legal obligations.
• Related to business transfers.
• Supporting our business operations.

Barter Campaign-Specific Purposes.

In addition to the foregoing, we process personal information for the following purposes specific to FameUp’s business model:

• Matchmaking: connecting Influencers and Brands based on relevant attributes (location, niche, audience size);
• Cash Campaign administration: processing Content Creation Fees, payouts at the $100 USD Account Threshold (or higher), tax form collection (W-9, W-8BEN), 1099-NEC issuance for cumulative cash payments of $600 or more in a calendar year;
• Barter Campaign administration: facilitating BCV declaration, generating QR codes for pickup/delivery confirmation, recording scan timestamps, tracking Content delivery deadlines (typically 3 days post-pickup);
• In-app communication: relaying briefs, messages, and notifications between Brand and Influencer;
• Compliance verification: confirming FTC Material Connection disclosures, monitoring Content for FTC compliance, verifying that delivered Content posts within agreed deadlines;
• Sanctions and dispute resolution: applying warnings, suspensions, or account terminations under T&C Section 7.3, mediating disputes between Brands and Influencers;
• Anti-fraud: detecting BCV understatement (>30% discrepancy from FMV), bot accounts, fake Campaigns, or suspicious patterns;
• Tax compliance and indemnification defense: maintaining records that demonstrate FameUp acts solely as a technical intermediary in Barter Campaigns and is NOT the source of income under IRC § 6041, § 6045, § 6041A;
• Reporting to Brands: monthly aggregated performance reports (views, engagement, audience demographics).

Security. We implement reasonable administrative, technical, and physical safeguards to protect your personal information from unauthorized access, use, alteration, or disclosure.

Data Retention. We retain personal information only for as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements.

Specific Retention Periods.

For clarity, the following retention periods apply to the principal categories of data:

• (a) Active account data (Influencer / Brand): for the duration of the account plus six (6) months after deletion or deactivation;
• (b) Cash Campaign data (including payment documentation, W-9/W-8BEN forms, 1099 forms, payout records): four (4) years from the end of the relevant tax year, in compliance with IRS retention rules (26 CFR § 31.6001-1) and applicable state tax law;
• (c) Barter Campaign data (BCV declarations, QR scan records, Content delivery records, in-app communications): three (3) years from the date of the Campaign, supporting Brand and Influencer documentation requirements under IRC § 61, § 6041, § 6045 and applicable state law;
• (d) Subscription and billing data: for the duration of the Subscription plus seven (7) years for accounting and audit purposes;
• (e) Marketing data (newsletter, promotional communications): until withdrawal of consent or unsubscribe;
• (f) Communications and complaint records: three (3) years from case closure;
• (g) Technical and security logs: twelve (12) months;
• (h) Cookies and tracking data: as specified in our Cookie Policy.

After the applicable retention period expires, data is deleted, anonymized, or aggregated, except where retention is required for the establishment, exercise, or defense of legal claims, compliance with a legal obligation, or where the data is necessary in the public interest.

III. HOW WE DISCLOSE PERSONAL INFORMATION

Generally, we may share and disclose personal information as described below:

• Service Providers. We may disclose information we collect to our service providers or agents who perform functions on our behalf, such as cloud service providers, payment processors, and auditors.
• We may disclose information we collect to our affiliates or subsidiaries.
• Influencer Content. Any Content that you create, submit, promote or otherwise disclose related to a Campaign you promote (or offer to promote) on behalf of a Brand (including associated metrics and performance information) is disclosed to the sponsoring Brand and may be further used, promoted, disseminated, disclosed, transformed, and otherwise processed by that Brand, subject to and as set forth in the Terms.
• Profile and Campaign Information. Your name, username, and any information that you provide as part of your account profile, and Content you submit may be available to, and searchable by, other users of the App.
• Supporting the Services. To provide and operate our Site, App, and other Services.
• Business Transfers. If we or our affiliates are or may be acquired by, merged with, or invested in by another company, or if any of our assets are or may be transferred to another company.
• In Response to Legal Process. We may disclose your information to comply with the law, a judicial proceeding, court order, or other legal process.
• To Protect You, Us, and Others. We disclose your information when we believe it is appropriate to do so to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to safety, violations of our Terms or this Policy, or as evidence in litigation in which we are involved.

We may share aggregated and/or pseudonymous information from which user identities have been removed and that are not reasonably linkable to any user.

Data Sharing in Cash and Barter Campaigns. When an Influencer is accepted into a Cash or Barter Campaign by a Brand, FameUp shares with the accepting Brand the following Influencer personal information through the App, as necessary for Campaign execution:

• Influencer’s name and/or social media handle;
• Profile photo and public statistics (followers, engagement rate);
• Contact details necessary for delivery of Barter Compensation (selected pickup location, telephone if applicable);
• In-app brief communications and messages necessary for Campaign delivery;
• Links to delivered Content (after publication).

Brand as Independent Controller. The Brand becomes an INDEPENDENT “business” or “controller” (under U.S. Privacy Laws) for this Influencer personal information. Brand commits, by accepting our Terms and the Advertiser Agreement, to:

• (a) use such data EXCLUSIVELY for executing the agreed Campaign and applicable record-keeping;
• (b) not retain the data beyond what is reasonably necessary (typically not exceeding 1 year after Campaign end, unless required by law);
• (c) not sell or share the data with third parties (except service providers acting on Brand’s behalf with appropriate contractual safeguards under U.S. Privacy Laws);
• (d) not use the data for unrelated marketing or profiling without separate, valid consent obtained directly from the Influencer;
• (e) honor Influencer rights requests directed to the Brand.

Reuse of Influencer data by Brand outside the Campaign, transmission to third parties, or use for unrelated purposes constitutes a breach of the Brand’s obligations under U.S. Privacy Laws and our Terms, and may result in suspension or termination of the Business Account.

Specific Categories of Recipients.

• (a) Brands (as independent controllers for Influencer data received in their Campaigns);
• (b) Influencers (limited access to public Brand information for active Campaigns);
• (c) Payment Processors — Stripe (as independent controller for payment data of Brands and Influencers);
• (d) Social media platforms — TikTok, Instagram (verification through public APIs and embedding of posted Content);
• (e) Tax authorities — IRS and applicable state tax authorities (for 1099 reporting on Cash Campaigns of $600+, or in response to lawful requests);
• (f) Cloud and hosting providers (located in the U.S. or EEA);
• (g) Auditors, accountants, and legal/tax advisors of FameUp, under confidentiality obligations;
• (h) Law enforcement, regulators (FTC, state AGs, ANSPDCP, CPPA), under valid legal requests.

 

IV. OUR USE OF COOKIES AND SIMILAR TECHNOLOGIES

We and our third-party providers (such as Google Analytics) use cookies, clear GIFs/pixel tags, JavaScript, local storage, log files, and other mechanisms to automatically collect and record information about your browsing activities and use of the Services. We may combine this usage data with other personal information we collect about you. We use this usage data to understand how our Services are used, track bugs and errors, provide and improve our Services, verify account credentials, allow logins, track sessions, prevent fraud, and protect our Services, as well as for targeted marketing and advertising, to personalize content and for analytics purposes.

Cookies.  Cookies are alphanumeric identifiers that we transfer to your computer’s hard drive through your web browser for record-keeping purposes. Some cookies allow us to make it easier for you to navigate our Site, while others are used to enable a faster log-in process or to allow us to track your activities while using our Site. Most web browsers automatically accept cookies, but if you prefer, you can edit your browser options to block them in the future. The Help portion of the toolbar on most browsers will tell you how to prevent your computer from accepting new cookies, how to have the browser notify you when you receive a new cookie, or how to disable cookies altogether. Some of the Services may not work properly if you disable cookies.

Pixel tags. Pixel tags (also referred to as web beacons, web bugs or clear GIFs) are tiny graphics with a unique identifier, similar in function to cookies. In contrast to cookies, which are stored on your computer’s hard drive, clear GIFs are embedded invisibly on web pages. We may use pixel tags in connection with our Services to, among other things, help us manage ads and content, and compile statistics about usage of our Services. We may also use pixel tags in HTML emails to our customers, to help us track email response rates, identify when our emails are viewed, and track whether our emails are forwarded.

Preferences. You can block or disable cookies for the device and browser you are using, through your browser and device settings; however, certain features on our Site and Services may not be available or function properly if you block or disable cookies.  

Currently, our systems do not recognize browser “do-not-track” requests. You may, however, disable certain tracking as discussed in this section (e.g., by disabling cookies). Where required by law, we honor browser ‘Do Not Track’ signals and provide mechanisms to opt-out of targeted advertising.

Global Privacy Control (GPC). Where required by law (including under California CCPA/CPRA regulations), we honor Global Privacy Control (GPC) signals as a valid opt-out request from the sale or sharing of personal information for cross-context behavioral advertising.

 

V. THIRD PARTY WEBSITES AND SERVICES

Our Services may link to other websites or online services (including those operated by our parent, affiliates, or others) that use, or are integrated with, our Services, but that are not covered by this Policy. Any access to and use of such linked websites or services is not governed by this Policy, but instead is governed by the privacy policies of those third-party websites. We are not responsible for the information practices of such third-party websites. We encourage you to review the privacy policies of those third parties. We require partners with whom we share data to implement appropriate privacy and security safeguards.

VI. CHILDREN

Our Services are not designed for children. We do not knowingly collect personal information from children under 13 in the U.S., or under 16 where applicable under EU law. If we discover such information, we will delete it and, where required, obtain verifiable parental consent.

COPPA Compliance. FameUp complies with the Children’s Online Privacy Protection Act (“COPPA”, 15 U.S.C. § 6501 et seq.) and FTC’s COPPA Rule (16 CFR Part 312). The Services are not directed to children under 13. Brands shall not knowingly initiate Campaigns directed to children under 13. If we become aware that we have collected personal information from a child under 13 without verifiable parental consent, we will delete such information promptly. Influencers between 13 and 17 may participate only with parental/guardian consent and only in age-appropriate Campaigns.

VII. INTERNATIONAL DATA TRANSFERS

If you are located outside the United States, we may transfer your information to the U.S. or other jurisdictions. Such transfers will be made in compliance with applicable legal requirements, including Standard Contractual Clauses or other safeguards recognized by law. For users in the European Economic Area, we rely on Standard Contractual Clauses approved by the European Commission to ensure adequate protection of your information.

VIII. CHANGES TO THIS POLICY

This Policy is current as of the Effective Date set forth above. We may change this Policy from time to time, so please be sure to check back periodically. We will post any changes to this Policy on our Site and Application.  If we make changes to this Policy that affect our practices with regard to the personal information we have previously collected from you, we will endeavor to provide you with notice in advance of such change by highlighting the change on our Services or sending you a notice at your email address of record with us.

IX. CONTACT US

If you have questions about the privacy aspects of our Services or would like to make a complaint, please contact us at contact@fameup.com

X. ROLES IN DATA PROTECTION FOR CAMPAIGNS

For transparency and compliance with U.S. Privacy Laws (including the principles of accountability, transparency, and purpose limitation), this Section clarifies the roles of the parties involved in the processing of personal information in Cash and Barter Campaigns.

10.1 FameUp, Inc. — Business / Controller.

For all data collected through the App and Site (including account creation, matchmaking, QR code generation, scan recording, in-app communications, IRS reporting on Cash Campaigns), FameUp acts as a “business” (under CCPA/CPRA) or “controller” (under VCDPA, CTDPA, UCPA, CPA, and other state laws) and fulfills its obligations under U.S. Privacy Laws (notice at collection, security, consumer rights, retention).

10.2 Brand — Independent Business / Controller.

When an Influencer applies to a Campaign and is accepted, the Brand receives certain Influencer personal information through the App (name, social handle, contact details, brief communications). For this data, the Brand becomes an INDEPENDENT “business” or “controller” under U.S. Privacy Laws and is responsible for its own compliance. The Brand is NOT a “service provider,” “contractor,” or “processor” of FameUp.

10.3 Influencer — Controller for Published Content.

The Influencer remains the controller of Content posted on the Influencer’s own social accounts (TikTok, Instagram), including any personal information of third parties appearing in such Content (e.g., customers filmed at the Brand’s location). The Influencer is responsible for obtaining the consent of any third parties filmed, in accordance with applicable law (e.g., California’s right of publicity under Civil Code § 3344, New York Civil Rights Law §§ 50-51).

10.4 No Joint Privacy Partnership.

The parties (FameUp, Brand, Influencer) act as INDEPENDENT controllers/businesses, without forming a joint controllership under U.S. Privacy Laws. Each party is responsible individually for its own privacy compliance. FameUp is NOT responsible for privacy violations committed by Brands or Influencers outside the App.

10.5 Data Processing Activities.

In limited scenarios (e.g., monthly performance reporting to Brands), FameUp may act as a “service provider” or “processor” for the Brand. In such cases, processing is performed strictly per the Brand’s instructions and for the communicated purpose, without FameUp using the data for its own purposes.

XI. YOUR PRIVACY RIGHTS UNDER U.S. PRIVACY LAWS

This Section sets forth your privacy rights as a U.S. consumer under applicable U.S. Privacy Laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), the Virginia Consumer Data Protection Act (“VCDPA”), the Connecticut Data Privacy Act (“CTDPA”), the Utah Consumer Privacy Act (“UCPA”), the Colorado Privacy Act (“CPA”), and analogous state laws.

11.1 Categories of Personal Information Collected (CCPA/CPRA Notice at Collection)

In the past twelve (12) months, FameUp has collected the following categories of personal information about California residents (and U.S. residents in general):

• (a) Identifiers: name, alias, postal address, online identifier (IP address, device ID), email, account name, social security number (collected by Payment Processor only), driver’s license or other identification, taxpayer identification number;
• (b) California Customer Records (Civil Code § 1798.80(e)) categories: name, address, telephone, education, employment, employment history, bank account number (Payment Processor), other financial information, medical information (NOT collected), health insurance information (NOT collected);
• (c) Protected classification characteristics: age (over 18), gender, parental status, race/ethnicity (only if voluntarily disclosed by Influencer);
• (d) Commercial information: records of products or services purchased (Subscription Plans), Campaign initiation history, Barter Compensation Value declarations, transaction history;
• (e) Internet/electronic activity: browsing history on Site, App usage, search history within App, interaction with advertisements;
• (f) Geolocation: approximate location (IP-based) and precise location (only if voluntarily provided for delivery of Barter Compensation);
• (g) Sensory data: audio (voice notes in App), visual (photos and videos uploaded by Influencers);
• (h) Professional/employment information: company name, role/title, business email;
• (i) Inferences: profiles regarding preferences, characteristics, behavior (e.g., engagement rate categories);
• (j) Sensitive personal information: see Section 11.4 below.

11.2 Sources of Personal Information

Personal information is collected from: (a) the consumer directly (account creation, profile, transactions); (b) third-party social media platforms (TikTok, Instagram public APIs); (c) Payment Processors (Stripe, for tax verification status); (d) automated technologies (cookies, device data); (e) marketing partners and lead lists (lawfully obtained).

11.3 Business or Commercial Purposes for Collecting

As detailed in Section II of this Policy, with specific purposes for Cash and Barter Campaign administration, FTC compliance verification, anti-fraud, IRS reporting, and tax compliance defense.

11.4 Sensitive Personal Information (CPRA)

“Sensitive Personal Information” under CPRA includes: social security number, driver’s license, state ID, passport number, account credentials with password, precise geolocation, racial/ethnic origin, religious/philosophical beliefs, union membership, mail/email/text content, genetic data, biometric identifiers, health information, sex life or sexual orientation.

FameUp processes the following categories of Sensitive Personal Information:

• (a) Account credentials (email + password) — for account access;
• (b) Social Security Number / Taxpayer ID — collected by Payment Processor (Stripe), NOT directly by FameUp, for IRS reporting on Cash Campaigns;
• (c) Precise geolocation — only if voluntarily provided by Influencer for Barter Compensation pickup;
• (d) Driver’s license / state ID — collected by Payment Processor for identity verification.

FameUp uses Sensitive Personal Information only for the purposes permitted under CPRA Section 1798.121, including providing the Services, security, fraud prevention, and legal compliance. We do NOT use Sensitive Personal Information for inferring characteristics about consumers.

11.5 Sale or Sharing of Personal Information

FameUp does NOT sell personal information for monetary consideration. FameUp does NOT share personal information for cross-context behavioral advertising in the past twelve (12) months. Personal information disclosed to Brands in connection with Campaigns is for the purpose of executing the Campaign (a business purpose under CCPA/CPRA), not for behavioral advertising.

11.6 California Consumer Rights (CCPA/CPRA)

If you are a California resident, you have the following rights, subject to certain exceptions:

• (a) Right to Know — request information about categories and specific pieces of personal information collected, sources, purposes, and third-party disclosures;
• (b) Right to Delete — request deletion of personal information (subject to legal exceptions including IRS retention rules and ongoing contracts);
• (c) Right to Correct — request correction of inaccurate personal information;
• (d) Right to Opt-Out of Sale or Sharing — opt out of the sale or sharing of personal information (FameUp does not sell or share — see Section 11.5);
• (e) Right to Limit Use of Sensitive Personal Information — request that FameUp limit use of Sensitive PI to that which is necessary to perform Services;
• (f) Right to Non-Discrimination — FameUp will not discriminate against you for exercising your privacy rights;
• (g) Right to Data Portability — receive your personal information in a portable, structured format.

11.7 “Do Not Sell or Share My Personal Information”

Although FameUp does not sell personal information for monetary consideration, you may exercise your right to opt-out of sharing for cross-context behavioral advertising at any time by:

• (a) clicking the link “Do Not Sell or Share My Personal Information” available in the footer of our Site;
• (b) sending us a Global Privacy Control (GPC) signal through your browser;
• (c) emailing us at privacy@fameup.com with the request “Do Not Sell or Share My Personal Information”.

FameUp shall implement the request within fifteen (15) business days, in accordance with CCPA/CPRA requirements.

11.8 How to Exercise Your Rights

To exercise your privacy rights, contact us at:

• (a) Email: privacy@fameup.com;
• (b) Phone: [insert toll-free number where applicable];
• (c) Online form: https://fameup.com/privacy-request (when available).

We will verify your identity before responding to your request, by validating your email address, requesting account information, or, where appropriate, additional documentation. We will respond within forty-five (45) days (with possibility of extension by an additional 45 days for complex requests). Authorized agents may submit requests on your behalf with appropriate written authorization and proof of your identity.

11.9 California Shine the Light (Civil Code § 1798.83)

California residents may request information regarding the disclosure of their personal information to third parties for those third parties’ direct marketing purposes by emailing privacy@fameup.com. FameUp does not currently disclose personal information to third parties for the third parties’ direct marketing purposes.

XII. PRIVACY RIGHTS UNDER OTHER U.S. STATE LAWS

Residents of certain other U.S. states may have privacy rights under applicable state law. To exercise any of these rights, contact privacy@fameup.com.

12.1 Virginia (VCDPA)

Virginia residents may: (a) confirm whether the controller is processing their personal data; (b) access their personal data; (c) correct inaccuracies; (d) delete personal data; (e) obtain a copy of personal data in a portable format; (f) opt-out of processing for targeted advertising, sale, or profiling that produces legal effects. Appeal mechanism is available.

12.2 Connecticut (CTDPA)

Connecticut residents have rights similar to Virginia, with additional rights including the right to opt-out of certain processing decisions made solely on automated processing.

12.3 Utah (UCPA)

Utah residents may: confirm processing, access, delete personal data, obtain a portable copy, and opt-out of targeted advertising and sale.

12.4 Colorado (CPA)

Colorado residents may: confirm processing, access, correct, delete, opt-out of targeted advertising, sale, profiling, and obtain a portable copy. Universal opt-out mechanism (UOOM) supported.

12.5 Other States

Residents of other states with privacy laws (including but not limited to Texas, Oregon, Montana, Iowa, Tennessee, Indiana, Delaware, New Jersey) may have similar rights. Please contact privacy@fameup.com to make an inquiry or exercise applicable rights.

XIII. TAX DATA AND IRS RETENTION REQUIREMENTS

Notwithstanding any consumer right to request deletion of personal information, FameUp must retain certain tax-related data for the periods required by U.S. federal and state tax law:

• (a) Form W-9, Form W-8BEN, and Form W-8BEN-E: at least four (4) years from the end of the tax year (per 26 CFR § 31.6001-1);
• (b) Form 1099-NEC and 1099-MISC, and supporting documentation: at least four (4) years (per IRS Publication 1281);
• (c) Cash Campaign payment records: at least four (4) years;
• (d) Barter Campaign records (BCV declarations, QR scan timestamps, Content delivery records): at least three (3) years, supporting documentation requirements for Brand and Influencer self-reporting under IRC § 61.

After the applicable retention period expires and subject to no other legal hold, the data will be deleted, anonymized, or aggregated upon a verified consumer request.

XIV. DATA BREACH NOTIFICATION

(a) Notification to Affected Individuals. In the event of a data breach involving personal information of FameUp users, FameUp shall provide notification to affected individuals as required by applicable U.S. state breach notification laws (including California Civil Code § 1798.82, New York General Business Law § 899-aa, and analogous statutes in other states), without unreasonable delay and consistent with the legitimate needs of law enforcement.

(b) Notification to Authorities. FameUp shall notify state attorneys general and other authorities as required by applicable law.

(c) Notification Between Brands and FameUp. In Campaign-related data sharing between FameUp and Brands, each party shall notify the other promptly (and in any event within seventy-two (72) hours) of any actual or reasonably suspected data breach involving the other party’s personal information.